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(57) Abstract 



A user interface (12) for a medical instrument such as a 
dialysis machine (10) is described which uses both a touch screen 
(14) and hard keys (16, 18 and 20) off of the touch screen (14) to 
effectuate a change in a parameter associated with the operation 
of the machine (10). The user interface (12) is connected to 
extracorporeal circuit (24), mounted above lower cabinet (22) of 
dialysis machine (10). After the user selects a new parametric value 
on the touch screen (12), the user presses a hard key (16, 1 8 or 20) to 
implement a verification routine to insure that the entered parameter 
is appropriate for a machine's (10), patient's treatment and the 
display on the touch screen (14). If the verification procedure ends 
in a positive result, the user is prompted to press a second hard 
key (16, 18 or 20) to confirm the change, causing an additional 
verification check to be performed. 
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DIALYSIS MACHINES WITH TOUCH SCREEN USER INTERFACE 

5 

NOTICE REGARDING COPYRIGHT 

10 A portion of the disclosure of this patent document contains matter subject to 

copyright protection. The copyright owner has no objection to the facsimile reproduction 
by anyone of the patent disclosure, as it appears in the Patent and Trademark Office files 
and records, but otherwise retains all copyright rights whatsoever. 

1 5 BACKGROUND OF THE INVENTION 

A. Field of the Invention 

This invention relates to the field of medical instruments and their user 
20 interfaces, and more particularly to a user interface and control method for a medical 
instrument such as a dialysis machine. 

B. Description of Related Art 

25 Dialysis machine are used for treating patients with inadequate kidney function. 

Hemodialysis machines typically include, among other things, an extracorporeal blood 
circuit comprising an arterial line, a blood pump, a dialyzer having a semipermeable 
membrane and a venous line. Blood is removed from the patient and pumped by the 
blood pump through the arterial line to the blood compartment of the dialyzer, where 

30 toxins and excess water are removed from the patient's blood. A dialysate solution is 
circulated on the other side of the membrane and carries away the toxins and removed 
water. The blood is then returned to the patient via the venous line. Peritoneal dialysis 
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machines prepare a dialysate solution which is introduced into the patient's peritoneal 
cavity. 

Dialysis machines typically have some sort of controls to regulate the operation 
of the machine. Such controls in the past were a rather unattractive and hard to use set 
5 of dials and switches that required trained medical professionals to use properly. More 
contemporary machines have a single user interface to allow a patient or medical 
practitioner to interact with the machine and adjust machine operation or treatment 
parameters, e.g., blood pump rate, dialysate temperature or flow rate, treatment time, 
heparin pump rate, etc. 

10 The patent to Grogan et al., U.S. No. 5,326,476, which is incorporated by 

reference herein, describes a touch screen that is used to control the operation of a 
hemodialysis machine. The touch screen is connected to a host microprocessor which 
controls operation of most of the active components of the machine. When the user 
wishes to change a treatment parameter, the user touches an icon on the touch screen and 

15 a key pad with an enter key pops up on the screen. The user enters the new value by 
touching the numbers on the key pad and pressing the enter button on the key pad. A 
verify button is then pressed on the touch screen if the user wishes to confirm the 
change. The patent also briefly describes a method of touching the touch screen to 
program a time-varying parameter, such as ultrafiltration removal over the course of a 

20 dialysis session. 

User interfaces that solely depend on a touch screen as a means for entering and 
confirming parametric values, such as described in the Grogan et al. patent, are 
vulnerable to failures in the touch screen display. If the touch screen is defective, the 
computer system may not receive the correct information from the touch screen or 
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interpret the information incorrectly. The present invention was designed to provide for 
redundancy and safety verification of parametric value changes independent of the 
operation of the touch screen, and thereby avoid accidental or unintended changes of 
parameters in the event of a defect in the touch screen. 
5 The user interface of the present invention provides for the combination of a 

touch screen, and at least one hard key that are separate and apart from the touch screen, 
whereby both the touch screen and the hard keys have to be pressed to enter and verify a 
change in a parametric value pertinent to the treatment or the operation of the machine. 
The computer control system for the machine also uses host and safety backup 
10 microprocessors which are responsive to the touch screen and hard keys to perform 
internal verification and confirmation checking procedures to verify that the change in 
parametric value requested by the user is proper. These features combine to offer safety 
benefits, robustness, and ease of use that are believed to be superior to user interfaces 
known in the prior art. 

15 Another object of the invention is to provide a user interface design for a 

medical instrument that is especially easy to use by a person that is not a technically 
trained medical professional, i.e., by the patient or a member of the patient's family. 
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MMARY OF THE INVENTION 



A system for controlling the operation of a dialysis machine is provided 
comprising in combination a user interface and a central computer control system. The 
user interface comprises a touch screen that displays messages and information as to the 
machine status to a user, and permits the user to touch the touch screen to select 
parametric values pertinent to operation of the machine. The user interface further 
includes at least one hard key off of the touch screen. The touch screen prompts the 
user to press the hard key to signify that the selection of the parametric value by the 
user has been completed. 

The central computer control system controls operation of the machine and is 
responsive to the touch screen and the hard key. The control system comprises a host 
central processing unit and a safety central processing unit (both comprising 
microprocessors) operatively connected to each other so as to enable an exchange of 
information related to the selected parametric value. 

When the user presses the hard key to indicate that the selection process is 
complete, this action causes the host and safety microprocessors to undergo a 
verification routine whereby the selected parametric value is checked for 
appropriateness for a patient connected to the machine so as to prevent changes to the 
parameter potentially harmful to the patient. If the verification routine results in a 
positive result, the process of changing the parameter may move forward. 

In a preferred embodiment, the hard key is directly wired to the safety central 
processing unit. The user interface also preferably comprises first, second and third hard 
keys, each of them directly wired to the safety central processing unit. The hard keys 
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are preferably given a distinctive appearance so as to enable the user to identify each 
hard key with a distinct functional attribute, e.g., stop, confirm, or entry. 
In another aspect of the invention, a method of operation of a dialysis machine is 
provided, the machine having a central computer control system and a user interface 
5 having a touch screen enabling a patient, by touching the touch screen, to select 
parametric values in a process of changing a parametric value pertinent to operation of 
the machine or to a dialysis treatment of a patient connected to the machine. The 
method comprises providing the user interface with at least one hard key and connecting 
the hard key directly to the central computer control system. After the user has selected 
10 the parametric value by touching the touch screen, the user is prompted to press the 
hard key to either 

(a) enter the parametric value selected, or, 

(b) if entry of the selected parametric value was accomplished by touching the 
touch screen, confirm the entry of the parametric value. 

15 In accordance with the above method, a failure in the touch screen to respond to 
touching of the touch screen to either enter or confirm parametric value changes may be 
avoided. 

In one embodiment of the invention, the central computer control system for the 
machine preferably includes host and safety CPUs, each comprising a microprocessor. 
20 The host and safety microprocessors each have has a first memory such as a random 
access memory (RAM) and a second memory, such as a hard disk, storing machine 
operation instructions and treatment prescriptions. In one aspect of the invention, a 
method is provided for using the touch screen, two hard keys, the first and second 
memories and host and safety microprocessors to change parameters to provide 
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enhanced redundancy and safety capabilities and avoid single point failures in the touch 
screen, host microprocessor, or host memories. The method comprises the steps of: 

a) touching the touch screen to select a parametric value; 

b) pressing the first hard key to enter the selected parametric value, the computer 
5 system responsively storing the selected parametric value in the first memory is 

associated with the host microprocessor; 

c) in response to pressing the first hard key, transmitting data associated with the 
selected value from the host microprocessor to the safety microprocessor and 
implementing a verification routine in the safety microprocessor. The safety 

10 microprocessor checks the parametric value for appropriateness for a patient connected 
to the machine so as to prevent changes from being implemented to the parameter 
potentially harmful to the patent. 

d) If the verification routine has a positive result, the safety sends a signal back to 
the host microprocessor granting approval to the change and stores the changed 

15 parameter in its first memory. The touch screen then displays a message prompting the 
user to press the second hard key to confirm the change selected in step a). 

e) If the user presses the second hard key to confirm the change, the host and safety 
microprocessors stores the new value in their respective second memories. The host 
and safety microprocessors then conduct a checking procedure to insure that the new 

20 value has been correctly stored in their second memories. 

These and many other aspects and features of the invention will be more 
apparent from the following detailed description of preferred embodiments of the 
invention. 
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BRI 



DESCRIPTION OF THE DRAWINGS 



In the following detailed description of presently preferred and alternative 



embodiments of the invention, reference will be made to the accompanying drawing 



figures, in which like reference numerals refer to like elements in the various views, and 
5 in which: 

Figure 1 is an illustration of a dialysis machine having a user interface in 
accordance with a preferred embodiment of the invention. 

Figure 2 is a cross-sectional view of the user interface in an embodiment in 
which the arm connecting the user interface to the machine is attached to the lower 
1 0 cabinet of the machine; 

Figure 3 is a block diagram of a control system governing the operation of the 
machine of Figure 1. 

Figure 4 is an elevational view of the user interface for the machine of Figure 1, 
showing the general organization of the screen into discrete regions associated with 
15 different general functions. 

Figure 5 is an illustration of the user interface of Figure 4, with the touch screen 
displaying a dialysis prescription during a treatment session, the display requesting the 
patient to press an icon associated with a treatment parameter if they wish to change a 



pressed the icon shown in Figure 5, showing up and down arrows that permit the user to 
select a different value for the treatment parameter. 



parameter. 



20 



Figure 6 is an illustration of the user interface of Figure 1 after the user has 
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DETAILED 



SCRIPTION OF THE PREFE 



EMBODIMENT 



Figure 1 is an illustration of a dialysis machine 10 having a user interface 12 
which may be employed in practicing the invention. The dialysis machine 10 in the 
preferred embodiment is a machine suitable for use outside of a traditional dialysis 
clinic setting, such as the home, nursing home or self-care clinic environment. The user 
interface 12 is designed to be easy to use by a person other than a trained health care 
professional, such as the patient or a family member of the patient. 

The preferred user interface 12 comprises a transparent touch screen 14, a 
display positioned immediately behind the touch screen 14, and a set of three hard keys 
or buttons 16, 18, 20 positioned below the touch screen 14. The touch screen 14 and 
hard keys 16, 18 and 20 are incorporated into a rigid housing 15 that is mounted to the 
distal end of a moveable arm 30. 

The machine 10 has a central computer control system 100 shown in block 
diagram form in Figure 3. The control system 100 is programmed to display 
information and messages to the patient or user of the machine on a display 14' (Figure 
2) immediately behind the touch screen surface 14. The control system 100, in 
cooperation with the hard keys 16, 18, 20 and touch screen 14, permits the user to 
change machine settings and enter information and otherwise control the operation of 
the machine before, during and after the treatment time. 

The dialysis machine 1 0 of Figure 1 has a water treatment module 23 and a 
dialysate preparation module 25 contained within the lower compartment 22 of the 
machine. These modules 23, 25 play no part in the present invention, and are described 
in detail in U.S. Patent 5,591,344 to Kenley et al. and assigned to Aksys, Ltd., the 
assignee of the present invention, and in PCT application publication no. WO 
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96/25214. These references describe a preferred dialysis machine suitable for use in the 
home environment. The Kenley et al. U.S. Patent No. 5,591,344 and published PCT 
application no. WO 96/25214 are both fully incorporated by reference herein. 
Additionally, the manner in which the dialysate solutions are prepared and circulated 
5 through the dialysate circuit is not particularly important to this invention and is well 
known in the art, and may be as described in the above-referenced Kenley et al. patent, 
or as described in the above-referenced Grogan et al. patent, or otherwise. Additionally, 
the user interface and method of operation is applicable to other types of medical 
instruments. 

10 The dialysis machine 10 further includes an extracorporeal circuit 24 mounted 

above the lower cabinet 22. The extracorporeal circuit is housed behind a door 27 in 
an enclosure 26 that is mounted to a turntable 28. The turntable 28 is moveably 
mounted to the top of the lower cabinet 22 such that the turntable 28, enclosure 26 and 
extracorporeal circuit 24 are capable of rotation as a unit relative to the lower cabinet 22 

15 about a vertical axis. The purpose of this rotation is to allow the extracorporeal circuit 
within the door 27 to be placed directly opposite a patient sitting next to the machine 10. 

The details of the extracorporeal circuit 24 of the machine 10 of Figure 1 are also 
not particularly germane to the present dialysis machine user interface. Blood is 
removed from the patient and introduced into an arterial line, and pumped by a blood 

20 pump to the blood chamber of a dialyzer. Blood-borne toxins and excess water are 
removed from the blood through the membrane of the dialyzer, and the blood is returned 
to the patient via a venous line. To prevent air from being introduced into the blood 
being returned to the patient, it is conventional in the dialysis art to place an air trap in 
the venous line. A method of using the user interface 12 to adjust the level in the air 
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trap is described in a IXS. patent application of Rodney S. ICcnley et al., Serial No. 

, which is incorporated by reference herein. Details of the extracorporeal circuit 

illustrated in Figure 1 can be found in the published PCT application of Kenley et al., 
publication no. WO 96/25214 and in the Kenley et al. U.S. Patent No. 5,591,344. 
5 The proximal end of the moveable arm 30 may be either attached to the 

enclosure 26 via a hinge 29 as shown in Figure 1 , to the turntable 28, or to the lower 
cabinet 22 as shown in Figure 2, such as to a corner of the upper surface of the lower 
cabinet, e.g., corner 32. Preferably, the user interface arm 30 is connected to the rest of 
the machine 10 via a hinge 29 or other suitable means such that the arm 30 can rotate 
10 about the vertical axis so as to position the user interface in a convenient orientation 
relative to a patient sitting or reclining next to the machine. 

The user interface 12 of Figure 1 is shown in cross section in Figure 2, along the 
lines 2-2 of Figure 1, in an embodiment in which the arm 30 is connected to the upper 
surface of the machine housing 22 at the comer 32 A hinge 29 connects the proximal 
15 end of the arm 30 to the housing 22 and allows the arm 30 to pivot about a vertical axis. 
A second hinge 49 at the distal portion of the arm 30 allows the user interface 12 to 
pivot about a vertical axis. A third hinge 47 in the user interface housing 15 allows the 
user interface 12 to tilt about a horizontal axis, i.e., to tilt down towards the patient if the 
patient is seated or reclining in bed, or up if the patient is standing. 
20 The extreme lower portion of the user interface housing 1 5 has a lower handle 

portion 17 below the hard keys 16, 18, 20. The handle 17 has an extreme lower lip 
17A that allows the user to grasp the interface housing 15, and a relatively large surface 
17B extending across a substantial portion of the width of the housing that allows the 
user to push the user interface back, causing the arm 30 to move about the hinge 29, or 
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rotate about the tilt hinge 47. The addition of a handle feature as described allows the 
user to interact with a specific portion of the user interface 12 away from the touch 
screen 14, whereby the user is less likely to push the touch screen 14 to move the touch 
screen about and accidentally operate the controls of the machine 10. The lower lip 17A 

5 and front surface 17B thus enable a user to manually manipulate the user interface 
housing 1 5 in a manner to cause rotation of the user interface about the housing axis H 
of Figures 1 and 3, the arm axis A, and the tilt axis T. 

The front of the user interface housing 1 5 is substantially flat and includes the 
substantially transparent touch screen 14 per se. The display 14' for the touch screen is 

10 placed within the housing immediately behind the touch screen 14. The hard keys 16, 
18, 30 are built into the front surface of the housing 15 immediately below the touch 
screen 14. 

Figure 3 is a block diagram of a computer control system module 100 installed 
in the lower cabinet 22 of the machine 10 that governs the operation of the machine. 

15 The use of a central computer control module to control active components of a dialysis 
machine is well known in the art and described in the above-referenced Kenley et al. and 
Grogan et al. patents. The module 100 controls the operation of the touch screen display 
14' to display messages and information concerning the status of the machine and 
treatment. The module 100 operates the touch screen display 14' to prompt the user to 

20 touch the touch screen 14 and the hard keys 16, 18 in the process of changing parameters 
or inputting information into the computer system 100. 

The touch screen 14 interfaces with the patient or other user and is provided for 
inputting commands or information from the patient into a human interface (HI) board 108 
and displaying messages on the display 14' immediately behind the touch screen 14 
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surface in response to commands from a host Central Processing Unit (CPU) 1 1 0 from 
the HI board 108. 

The hard keys 16, 18 and 20 are each a pair of physical, electrically isolated 
switches. One switch in each of the hard keys 16, 18, and 20 is preferably directly 
5 connected, and essentially hard wired, to a backup or safety CPU 1 1 6, and the other switch 
in the hard keys is connected to a host CPU 1 10. The switch for the emergency stop hard 
key 20 for the host CPU 1 10 is preferably directly connected to host CPU 1 10 from the HI 
board 108 over a separate conductor, as shown by the dashed line 101 . 

While FIG. 3 shows the connection between the hard keys 16, 18 and 20 going to 
10 the safety CPU 1 16 via the HI board 108 and conductor 105, the connection between the 
hard keys and the safety CPU 1 16 is considered a direct connection since the only function 
performed by the HI board 1 08 is debouncing and electrical interfacing the switch signals 
before they are sent to the Safety CPU 1 16. The connection is also considered a "direct 
connection" in the sense the signal path is intentionally designed to not share any circuitry 
1 5 with the Host CPU 1 1 0 or the microprocessor on the HI board 1 08. 

The switch for the Red hard key 20 that is directed to the host CPU 1 10 is directly 
connected to the host CPU via the HI board 108, which performs debouncing and 
electrical interfacing, but the circuit does not share any other circuitry on the HI board 108 
and the status of the switch is sent to the host CPU over the conductor 101 as described 
20 above. The switch for the host CPU 110 for the green and blue hard keys 18 and 16, 
respectively, are subject to debouncing by the microprocessor on the HI board 108, and the 
status of the switches is sent over the bus 103. 

A set of indicators 104, including lights and audio indicators, a buzzer 121, and a 
speaker 106, alert the patient to abnormal conditions in the machine 10, and provide 
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information as to the status of the modes of operation of the machine. The indicators 1 04 
receive input signals from the host or safety CPU via the HI board 108. The buzzer 121 
receives input signals from the safety CPU 116. Thus, audio and visual alarm activities 
are split among the two microprocessors 110, 116 in case one of them fails to work 
5 properly. 

The host CPU 1 10 is connected via high speed digital data busses 1 1 1 and 1 1 3 to a 
driver board 112 and an analog board 114. The host CPU 110 comprises a 
microprocessor and implements a software program governing the operation of the 
machine stored in a hard disk memory 130 or a read only memory (not shown). The hard 

10 disk 130 stores other operational information, such as the patient's prescription, data from 
the passive components, and data input from the patient via the touch screen. An analog 
board 114 contains analog to digital converters for converting incoming analog signals 
from the passive sensors in the machine 22 (such as thermistors, pressure sensors and 
conductivity cells) into digital signals. The driver board 1 12 receives commands from the 

15 CPU 1 10 and sends the commands to the valves, pumps, heaters, motors, and other active 
components of the machine (represented by 120) to cause the components to change their 
status, e.g., commence or cease operation or change rate, as in the case of a pump, or open 
and close, as in the case of a valve. The signals from the passive components 122 of the 
system, for example, the conductivity sensors, pressure transducers, thermistors, etc. 

20 provide their inputs to the analog boards 1 14 and 118. The CPU 110 and driver board 
112 together act as a controller for the active components. 

The analog board 118 provides digital information on a bus 117 to the safety 
CPU 116. The safety CPU 116 comprises a microprocessor and acts as watchdog of 
critical system sensors, and provides enable signals to the driver 112 that allow certain 
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driver commands to issue to the active components 1 20 (such as signals to the valve and 
air pump to raise or lower the level in the drip chamber in the extracorporeal circuit). 
These features are described in more detail below as they relate to the changing of machine 
parameters. Communications between the safety CPU 1 16 and host CPU 1 10 are passed 

5 on data bus 107. The safety CPU 1 16 activates a buzzer or other suitable alarm 121 if 
certain alarm conditions are present in the machine. 

Both the host and safety CPUs 110 and 116 have an associated random access 
memory 132 and 134, respectively, for use in processing input information from the touch 
screen 1 4, for temporary storage of data, and for performing other tasks. In a preferred 

10 embodiment, the host CPU 110 and hard disk 130 are based on an off-the-shelf IBM 
compatible personal computer platform based on an Intel 386 or 486 microprocessor, or 
the equivalent. A similar microprocessor platform may be used for the safety CPU 116. 
Of course, other types of microprocessor platforms may be used. The safety CPU 116 also 
has its own hard disk memory 123. Note that the Safety and Host CPUs 116 and 1 10 do 

15 not share a hard disk, but rather have their own hard disk, for safety and redundancy 
reasons. 

The host CPU 110 preferably has a modem and telephone line interface, a local 
area network (LAN) gateway card and interface and/or an RS-232 serial port (not shown) 
for allowing the machine 10 to receive and send messages to remote locations by a suitable 
20 communication link. The choice of which type of input/output interface will depend on 
where the machine 10 is installed (e.g., the home (modem), in a hospital (LAN interface), 
in a nursing home (modem and/or RS-232 and/or LAN). Potential entities that may wish 
to access information from the machine include a physician or nurse, the machine 
manufacturer, a service technician, and a remote monitoring facility such as a central 
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station monitoring a plurality of machines. Preferably, machine status and treatment 
information is stored in the hard disk 130 and is accessible to the outside via the modem 
and host CPU 1 10 using an interactive program running on the host CPU 1 10 and at the 
remote site. The host CPU computing platform 110 also preferably implements a 

5 Microsoft ™ graphical user interface operating system, and also Internet access software 
to allow messages to be sent to and retrieved from the machine 10 via the Internet. 

Figure 4 is an elevational view of the user interface 12 of Figure 1 showing a 
display on the touch screen 14 that is used prior to the start of the treatment. The 
illustrated display, and preferably all of the displays for the user interface, is organized 

10 into discrete zones or portions extending across the width of the display. This 
organizational scheme assists the user to know where to look on the display for certain 
functions, icons, and information throughout all of the displays. One portion is 
preferably devoted to displaying instruction and status information to the user. Another 
is preferably devoted to displaying - primary treatment and machine activities and 

15 functions. A third portion is preferably used for secondary machine activities and 
functions. 

An embodiment of this general organizational scheme is shown in Figure 4. The 
display has an upper portion 60 devoted to secondary activities and functions, and 
includes an icon 62 for a guide, which allows the user to gain information as to the 
20 machine when the icon 62 is pressed, a messages icon 64 indicating whether the patient 
has received new messages (e.g., via the Internet or public telephone network), and a 
problem report icon 66. The problem report icon 66 is a means for the machine to 
notify the patient of problems in a non-treatment mode. The screen display also has a 
time and day section 68. 
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The middle portion of the display 70 conveys status information to the patient, 
such as when the next treatment time is to begin. The portion 70 is given a paper pad 
type of look to reinforce the role played by this portion of the screen. 

The lower portion 72 has a set of icons related to primary treatment and machine 
5 functions. These icons, when pressed, lead to additional screens that allow the patient 
to obtain information or enter data as to basic machine and treatment functions. These 
icons include an icon indicating treatment information 74, a dialysis schedule icon 76, a 
prescription icon 78 and a machine set-up icon 80. 

When the user wishes to enter information into the machine from any of these 
10 menus, the user presses the touch screen 14 to navigate through various screen displays 
until they arrive at the appropriate screen for the action they wish to take. 

As noted above, the user interface of Figure 4 has at least one hard key (a 
physical button) positioned below the touch screen 14. Three hard keys are preferably 
provided, each with a distinctive visual appearance to assist the user to identify the hard 
15 key with a distinct functional attribute: a blue hard key 16, a green hard key 1 8 and a red 
hard key 20. The hard keys 16, 18 and 20 preferably consist of two electrically 
independent switches, one sending signals to the safety CPU 116 and the other sending 
signals to the HI board and host CPU 1 10 as described above. 

The blue hard key 1 6 is connected to the host CPU 1 10 via the HI board 608, and 
20 is hard wired to the safety microprocessor 116. The blue hard key 16 is solely 
associated with an entry function. The user presses the blue hard key 16 when the user 
is finished editing a parameter during the process of changing parametric values for the 
machine. The blue hard key 16 is directly hard wired to the safety CPU 116 due to the 
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fact that the safety CPU 116 is involved when parametric values are changed, as 
discussed below. 

The green hard key 18 is a means for the user to confirm parametric value 
changes and some of the mode transitions of the machine 10. The green hard key 18 is 
5 connected to the host CPU 110 via the user interface software and hardware (i.e., HI 
board 108) and is hard wired to the safety CPU 116. The meaning associated with the 
pressing of the green hard key 1 8 also depends on the context of the current display and 
the current state of the machine 10. Due to safety considerations, the safety CPU 1 16 
must have an independent means for determining the user's intention to change 

10 parametric values, i.e., independent of the touch screen or the host CPU, hence the green 
hard key 18 is directly connected and essentially hard wired to the safety CPU 1 16. 

The red hard key 20 is a means for the user to issue an "Immediate Stop" 
command to the machine 10. The host and safety CPUs 110 and 116 respond by 
disabling a predetermined group of active components of the machine that leaves the 

15 machine in a patient-safe mechanically stopped condition. The meaning of the red hard 
key 20 is always the same regardless of the state of the machine 10. Unlike the blue 
and green hard keys, the red hard key 20 is directly connected and essentially hard wired 
to both the host and safety CPUs. Both microprocessors have the ability to disable the 
same group of active components, and will, redundant with each other, disable the active 

20 components. 

As noted above, in order to assist the user to become familiar with the functions 
provided by the hard keys, they are preferably given a different color. Since one of the 
keys 20 is associated with an emergency stop function it is given a red color. The other 
keys 16 and 18 have more latitude in their selection of color, and we prefer to use a 
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green key 18 to be generally identified with a confirmation function. The third key 16 
is identified with an entry function, and is blue in the preferred embodiment. To assist 
further in reinforcing their different functions, they may be given different shapes, e.g., 
octagon, square and triangle. Other colors and shapes are of course possible. 



are used in a process to adjust certain parameters pertinent to the operation of the 
machine or the dialysis treatment. Figure 5 is an illustration of the user interface 12 
showing a display on the touch screen 14 that can be accessed before or during the 
dialysis session. The touch screen 14 displays a message prompting a user to touch an 

10 icon 140 if they wish to change the level of the drip chamber in the extracorporeal 
circuit. When this icon 140 is pressed, an illustration of the blood drip chamber is 
displayed on the screen and the user indicates the current level in the illustration. The 
host CPU determines from the indicated level whether the level needs to rise or fall, and 
by approximately how much, to bring the level back to a predetermined desired level. 

15 This process and variations thereto are described in further detail in the above- 
referenced Kenley et al. patent application filed concurrently, serial no. 



and 152 that display current treatment settings in numerical form. The region 154 below 
20 the icons 142, 144, etc. can be used to display other information or to allow the patient 
to navigate to the previous screen or additional screens, obtain information, or report 
problems. 

The display of Figure 5 requests the patient to press an icon associated with a 
treatment parameter if they wish to initiate the process of changing the parameter. When 



5 



In accordance with the invention, the touch screen 14 and hard keys 16 and 18 



, incorporated by reference herein. 



The display of Figure 5 further includes several icons 142, 144, 146, 148, 150 
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the user presses an icon, for example, the treatment length icon 148, the display is 
modified to that shown in Figure 6. Up and down arrows appear below the icons 142, 
144, 146 et al. adjacent to the selected treatment parameter and the treatment parameter 
icon 148 is highlighted, e.g., made a brighter or a different color from the other icons. 
5 The user presses the up or down buttons 1 80, 1 82 to select the new value. The user 
then signifies that the editing is complete by pressing the blue hard key 16. After 
verification procedures are performed, the user is then prompted to confirm the change 
by pressing the green hard key 1 8. 

In the preferred embodiment of the invention, the above process invokes 
10 operations with both the host and safety CPUs 110 and 1 16 to provide redundancy and 
safety features, which will now be described in detail in conjunction with Figures 3, 5 
and 6. 

The user touches one of icons 142, 144, 146, 148, 150 and 152 to indicate which 
parameter they wish to edit. A pair up and down arrows such as shown in Figure 6 then 

15 appear. The user presses the up and down icons to select the new parametric value. In 
response to a prompt, the user indicates that the editing process is complete by pressing 
the blue hard key 16. An alternative would be to prompt the patient to press the green 
hard key, but this is a less desirable alternative since association of the green hard key 
1 8 with a confirmation function would be diluted. A further possibility would be to 

20 press the activated icon, e.g., icon 144, a second time in response to a prompt. The 
preferred action of pressing the hard key 16 off the touch screen 14 initiates storage of 
the changed parametric value into the working RAM 132 for host CPU 110 <Figure 3). 
A CRC (Cyclical Redundancy Check) value is calculated by the host CPU 110 for the 
set of parametric values currently displayed on the screen. The CRC check is 
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calculated by the host CPU 1 10 only (at this point), and only in response to the pressing 
of the blue or entry hard key 16. 

The following information is then sent from the host CPU 1 1 0 to the safety CPU 
1 16 over the bus 107 in response to a pressing of the entry hard key 16: a unique screen 

5 identifier associated with the display currently on the touch screen 14, the current values 
of all the modifiable parameters displayed on the screen, a unique parameter identifier 
associated with the parameter to be changed, and the calculated CRC value. The data is 
stored in the Safety CPU 1 16's RAM 134. 

The safety CPU 1 1 6 then performs a verification routine to determine that the 

10 requested change to the parameter is appropriate for the patient and is consistent with 
the current status of the machine 10 and current display, and prevent any changes that 
could be harmful to the patient. Specifically, in a preferred embodiment, the safety CPU 
116 verifies that the screen displayed could be displayed given the current state of the 
machine 10. It also verifies that only one parametric value, of all the modifiable 

15 parametric values associated with the current screen, has changed. It also verifies that 
the parameter identified by the host microprocessor 110 is editable on the specified 
screen. If further verifies that the parameter that the host has identified as being the 
changed parameter is the same one identified by the safety CPU 116. This verification 
is done by the Safety CPU 1 16 using its own copy of the treatment information stored in 

20 its hard disk 1 23 and comparing this information with the information sent from the host 
CPU 110 to determine which parameter for the screen has changed. The safety CPU 
116 further verifies that the parametric value that changed passes all range, resolution, 
format and other appropriate validation and safety tests. This is accomplished by 
comparing the proposed new value with stored values on the hard disk 123 associated 
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with permissible range oFvalues and other validation criteria forthe patient. The values 
stored on the hard disk 123 may be either modifiable by a doctor's prescription loaded 
into the hard disk 123 or validation or safety criteria set at the time of machine 
manufacture. Finally, the safety CPU 116 calculates a CRC on the set of parametric 
5 values currently displayed and determines whether the CRC value matches the CRC 
value calculated by the host CPU 110. It will be appreciated that the above specific 
verification routine is not the only possible verification routine and can be modified to 
be more or less stringent for different parameters and states of the machine. 



1 0 host CPU 1 1 0 and treats the failure in a manner to that of a triggered protective system, 
such as by displaying an error message or activating one of the indicators 1 04 and/or the 
buzzer 121. 

If the safety CPU 116 does not detect an error, it sends a signal to the host CPU 
1 10 indicating the tests were passed and notifying the host 1 10 that the host 1 10 may 
15 continue. The safety CPU 116 transfers back to the host CPU 110 the data stored in 
RAM 134 that was forwarded from the host 110 (while keeping a copy in RAM 134), 
and the CRC calculated by the safety CPU. This data is stored in work space in the host 
CPU's RAM 132. 

The host CPU 1 10 then compares the CRC calculated by the safety CPU 1 16 to 
20 the host's CRC value, compares all the parameter values returned by the safety CPU 116 
to the values it originally sent, and treats any mismatch in a manner similar to that of a 
triggered protective system. 

If the comparison is valid, then the host CPU 1 16 updates the screen display with 
the parametric values returned by the safety CPU and stored in RAM 132. The host 



If the safety CPU 1 16 detects an error in the verification routine it notifies the 
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CPU 110 then causes the touch screen 14 to display a prompt to the user that they must 
press the green hard key 18 to confirm the pending change to the displayed parametric 
value. Note that, up until this point, the data associated with the changed parameter is 
not yet loaded into the hard disk 130 that contains the program, and thus the machine 
cannot operate in accordance with the selected parametric value. Rather, a confirmation 
step must still occur, i.e., a pressing of the green hard key 18 off of the touch screen. 

When the user presses the green hard key 18 to confirm the change, the host 
microprocessor calculates a new CRC file and then writes the RAM 132 copy of the 
parameters and the CRC to the hard disk 130. The safety CPU 116 simultaneously 
performs the same actions with its copy of the CRC and the parameters stored in RAM 
134, writing the RAM copy and CRC value to its hard disk 123. Both host and safety 
CPUs will then reload their sets of parameter and CRC data into their respective RAM 
and verify with each other that the new CRC value agrees with each other. The host 
CPU 110 then removes the "Press the green key to confirm" prompt and enables a 
screen navigation prompt allowing the user to navigate through other screens. At this 
point, the user can either navigate off the screen of Figure 6 or select another parameter 
for editing. The changing of the parametric value is now complete since the parametric 
value data is loaded into the hard disks of the host and safety CPU. 

While the above discussion has assumed that the user only modifies one of the 
several parameters from the display of Figure 6, the user may choose to modify another 
parameter on the same screen after the blue hard key 16 has been pressed. The user does 
not have to press the green hard key for every single parameter change. For example, 
the user may select a new blood flow rate (using icon 142), then press the blue hard key 
16 to signify completing of the editing process, select a new fluid removal rate (using 
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icon 146), then press the blue hard key 16, then edit the dialysate temperature (using 
icon 150), and then press the blue hard key 16. After each pressing of the blue hard 
key 16, the above-described verification routine is performed. If the verification 
routine results in a positive result for each pressing of the blue hard key, the display will 

5 continue to display a "press the Green hard key to confirm" prompt. The user will press 
the green hard key once to confirm that they intend to change all the parametric values 
that have been selected. 

Since the new updated parametric value(s) are now entered into the hard disk 

' memory 130, the host CPU 110 commands the relevant active components of the 

1 0 machine 1 0 in accordance with the new parametric value. 

This use of the hard keys in the process of changing parametric values is 
considered to be distinctly different and an improvement from merely touching the 
touch screen to enter or change values, since the touch screen can be prone to failures. 
Failures in a touch screen to properly respond to a touching of the surface can arise in a 

15 variety of ways, such from mechanical failures due to repeated use over a prolonged 
period of time, the screen surface material taking on a depression or set in a particular 
area from repeated use, electro-static shock causing the grid to fail in particular area, 
high electromagnetic fields causing the contacts to touch, cleaning agents leaking 
around the periphery of the screen, and so on. By also using hard keys or physical 

20 switches directly wired to the host and safety CPU to change values, the 
microprocessors have an independent means for determining whether the user has 
entered values or intends to confirm the changes. Further, by virtue of connecting the 
hard keys to both microprocessors, and using the pairs of redundant host and safety 
memories to check against each other, a failure in either microprocessor or associated 
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memories will be detected, allowing for alarms or other protective action to be initiated 
while maintaining patient safety, 

The above-described method of using the touch screen and hard keys to change 
machine or treatment parameters is also applicable to changing operational modes in the 

5 machine. For example, if the machine 10 is in a prepare dialysate solution mode, the 
display 14 may display a prompt indicating that the user should press the green hard key 
to indicate that they are ready to enter into a prepare access site mode or a dialyze mode. 
Another example would be when the user is finishing the dialysis session and indicates 
to the machine that they are ready to end dialysis and begin a rinseback mode. The user 

10 is prompted to press a hard key (e.g., the green hard key) to indicate that they wish to 
confirm that they are ready to start the next mode of operation. Further, by virtue of the 
connection of the hard keys to both the host and safety CPUs, a verification routing can 
be performed by both CPUs to confirm that the machine is in a state where the change is 
mode is safe for the patient. 

15 For some mode changes, it is presently contemplated that little or no user 

interaction with the machine is necessary. For example, the transition from a clean and 
rinse mode to a prepare dialysate solution mode may be made without requiring user 
involvement. However, the current mode of operation is preferably communicated to 
the patient, such as by displaying a message telling the user what mode the machine is in 

20 (e.g., clean and rinse mode) and an illustration communicating how much time remains 
until the machine has completed the present mode. 

It will be appreciated that various modifications may be made to the methods 
described herein without departure from the true scope and spirit of the invention. 
Furthermore, as used in the claims, the term "touch screen" is intended to mean the 
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combination of the transparent physical surface touched by the user and the display 
immediately behind the surface touched by the user. The term "hard key", as used in the 
claims, is not intended to be limited to a button or key having two physical switches 
directed to host and safety CPUs, but rather, unless otherwise stated, is intended to mean 
simply a manually manipulable physical switch off of the touch screen such as a button 
operatively connected to a central computer system for the medical instrument. This 
true scope and spirit is defined by the appended claims, interpreted in light of the 
foregoing specification. 
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WE CLAIM: 

1 . A system for controlling the operation of a dialysis machine, comprising, in 
combination: 

a) a user interface comprising : 

5 1) a touch screen displaying messages and information as to said machine to a user 

and permitting said user to touch said touch screen to select at least one 
parametric value pertinent to operation of said machine or pertinent to a 
treatment by said machine, and 
2) at least one hard key off of said touch screen, said touch screen prompting said 
10 user to press said hard key to signify that the selection of said at least one 

parametric value by said user has been completed; 

b) a control system within said machine for controlling operation of said machine 
and responsive to said touch screen and said at least one hard key, said control system 
comprising a host microprocessor and a safety microprocessor operatively connected to 

15 each other so as to enable an exchange of information related to said at least one selected 
parametric value, 

c) said pressing of said hard key causing said host and safety microprocessors to 
undergo a verification routine whereby said selected parametric value is checked for 
appropriateness for a patient connected to said machine so as to prevent changes to 

20 said parameter potentially harmful to said patient. 

2. The system of claim 1, wherein said hard key is directly wired to said safety 
microprocessor so as to permit said safety microprocessor to respond to a pressing of 
said hard key. 
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3. The system of claim 1, wherein said user interface comprises first, second and 
third hard keys, said first hard key associated with an emergency stop function for said 
machine, said second hard key associated with an entry function for entering said 

5 selected at least one parametric value, and said third hard key associated with a 
confirmation function for confirming that the at least one entered parametric value is 
intended by said user of said machine, said touch screen prompting said user to touch 
either said second hard key or said third hard key after said user has touched said touch 
screen to select said at least one parametric value. 

10 

4. The system of claim 1, wherein said user interface comprises at least first and 
second hard keys, said first hard key having a first color and said second of said hard 
keys having a second color distinctly different from said first color. 

15 5. The system of claim 4, wherein said user interface comprises a third hard key 
having a third color, wherein said first color comprises red, and said third color 
comprises green. 

6. The system of claim 1 , wherein said user interface comprises first, second and 
20 third hard keys, each of said first, second and third hard keys hard wired to said safety 

microprocessor. 

7. The system of claim 1, wherein said user presses a second hard key to confirm that 
said selected at least one parametric value is intended by said user. 

27 

SUBSTITUTE SHEET (RULE 26) 



BNSOOCID: <WO 96357 47 A 1 t > 



. WO 98/35747 



PCT/US97/13969 



8. In a dialysis machine having a user interface and a central computer system to 
control the operation of said dialysis machine, said user interface having a touch screen 
enabling a patient, by touching the touch screen, to select parametric values in a process 

5 of changing a parametric value pertinent to operation of said machine or pertinent to a 
dialysis treatment of a patient connected to said machine, the improvement comprising: 
providing said user interface with at least one hard key; 
connecting said hard key to said central computer system, and 
after said user has selected said parametric value by touching the touch screen, 
10 prompting said user of said machine to press said hard key to either 1 

(a) enter said parametric value selected by touching said touch screen, or, if 
entry of said selected parametric value is accomplished by touching the touch 
screen, 

(b) confirm the entry of said parametric value, 

15 so that a failure in said touch screen to respond to touching of the touch screen to 

either enter or confirm parametric value changes may be avoided. 

9. The improvement to a dialysis machine of claim 8, wherein said improvement . ,"; ) 
further comprises: 

20 providing said central computer system with a host microprocessor and a safety 

microprocessor and connecting said hard key to both said host microprocessor and said 
safety microprocessor, with said hard key directly wired to said safety microprocessor. 



28 

SUBSTITUTE SHEET (RULE 26) 



BNSDOCJD: <WO 9635747A1 I > 



-WO 98/35747 PCT/US97/13969 

10. The improvement to a dialysis machine of claim 8, wherein said improvement 
further comprises: 

providing said user interface with first, second and third hard keys, said first hard 
key associated with an emergency stop function for said machine, said second hard key 
5 associated with an entry function for entering said selected parametric value, and said 
third hard key associated with a confirmation function for confirming that the entered 
parametric value is intended by said user of said machine, said touch screen prompting 
said user to touch said second hard key after said user has touched said touch screen to 
select said machine operation parameter. 

10 

11. A method of changing a parametric value pertinent to operation of a dialysis 
machine, said machine having a user interface comprising a touch screen, a first hard 
key and a second hard key, and a control system responsive to said first and second hard 
keys comprising a host microprocessor and a safety microprocessor, said host and 

15 safety microprocessors each having a first memory and a second memory storing 
machine operation instructions, the method comprising the steps of: 

a) displaying on said touch screen a display permitting a user to touch said touch 
screen to select a parametric value associated with a parameter pertinent to operation of 
said machine or pertinent to a dialysis treatment conducted by said machine; 
20 b) pressing said first hard key to enter said selected parametric value, said control 
system responsively storing said selected parametric value in said first memory 
associated with said host microprocessor; 

c) in response to pressing said hard key, transmitting data associated with said 
parametric value and said parameter from said host microprocessor to said safety 



29 

SUBSTITUTE SHEET (RULE 26) 



- WO 98/35747 PCT/US97/13969 

microprocessor and implementing a verification routine in said safety microprocessor, 
wherein said parametric value is checked for appropriateness for a patient connected to 
said machine so as to prevent changes to said parameter potentially harmful to said 
patient; 

5 d) if said verification routine has a positive result, prompting said user to press said 
second hard key to confirm the change selected in step a) and responsively pressing said 
second hard key and storing said data associated with said parametric value in said first 
memory associated with said safety microprocessor; 

e) storing in said second memory associated with said host and safety microprocessors 
10 said data associated with said parametric value; and 

0 checking, with said host and safety microprocessors, the contents of their respective 
first and second memories against each other to insure that said data associated with 
said parametric value has in their respective first and second memories is the same. 

15 12. The method of claim 1 1, wherein said second memory associated with said host 
microprocessor comprises a hard disk storing a prescription for a patient using said 
machine. 

13. The method of claim 1 1, wherein said first and second hard keys are directly 
20 connected to said safety microprocessor. 

14. The method of claim 1 1, wherein said verification routine comprises the steps 
of: 
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calculating with said host microprocessor a first cyclical redundancy check value 
associated with said selected parametric value; 

transmitting from said host microprocessor to said safety microprocessor, in 
addition to said parametric value, said first cyclical redundancy check value, a first 
5 identifier associated with a screen displayed by said touch screen during said step of 
selection of said parametric value, and a second identifier associated with said 
parameter; 

calculating with said safety microprocessor a second cyclical redundancy check 
value associated with said data; 
10 verifying with said safety microprocessor from said first and second identifiers 

that said touch screen could display said screen given the current state of said machine 
and that said parameter may be changed on said screen; 

verifying with said safety microprocessor that said parametric value associated 
with said data is within a predetermined range associated with said parameter, and 
15 verifying with said safety microprocessor that said second cyclical redundancy 

check matches said first cyclical redundancy check; and, in the event that said 
verification steps result in a positive result, 

transmitting an approval signal from said second microprocessor to said first 
microprocessor indicating that said positive result was achieved. 

20 

15. An improved user interface and screen display apparatus for a dialysis machine 
that promotes ease of use of said user interface by a user operating said machine without 
immediate supervision by trained professional medical personnel, comprising: 
a) a touch screen; 
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b) a screen display for said touch screen, said screen display arranged in at least 



two portions extending across said display, said at least two portions 



comprising: 



I) 



a first portion displaying instruction and status information to a user 



5 



of said machine; and 



2) 



a second portion adjacent to said first portion on said display and 



displaying a plurality of icons, each of said icons associated with a 



specific functional activities associated either with said machine or a 



treatment session of said machine; and 



10 



c) at least one hard key associated with said display, said first portion of said 



■J 



screen display prompting said user to press said at least one hard key in a process of 
entering or confirming entry of information into said machine. 

16. The apparatus of claim 15, wherein at least one of said icons is selected from 
15 the group of icons consisting of treatment icon, a schedule icon, a prescription icon, and 
a setup and care icon. 



17. The apparatus of claim 15, wherein said first and second portions are arranged 
above each other and extend across the width of said display, and wherein said screen 
20 display further comprises a third portion adjacent to said first and second portions, and 
wherein said third portion of said screen display displays a plurality of icons, at least one 
of said icons associated with a message transmission or receiving function for said 
dialysis machine. 
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18. An ergonomically efficient and easy to use human interface for a dialysis 
machine, said dialysis machine having an enclosure containing hydraulic circuitry for 
said machine comprising: 

an arm having a proximal end connected to said machine and a free distal end 
portion; 

a display assembly connected to said free distal end portion of said arm, said 
display comprising a touch screen, 

wherein said proximal end of said arm is mounted to said machine in a manner 
permitting said arm to rotate about at least one axis relative to said machine to thereby 
position said display at the distal portion thereof in a multitude or different positions 
relative to said machine; and 

wherein said display is connected to said free distal end portion of said arm by a hinge 
means for permitting a user of said machine to rotate said display about at least one axis 
relative to said arm. 

19. The apparatus of claim 18, further comprising a second hinge means connected 
to said display for permitting said display to be rotated relative to said arm about a 
horizontal axis. 

20. The apparatus of claim 1 8, wherein said display further comprises at least one 
hard key mounted adjacent to said touch screen in said display assembly. 

21. The apparatus of claim 20, wherein said display assembly further comprises 
three hard keys mounted adjacent to said touch screen. 
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22. The apparatus of claim 2 1 , wherein said three hard keys are each a distinctly 
different color. 



23. The apparatus of claim 2 1 , wherein said three hard keys are each a distinctly 
different color and wherein at least one of said hard keys has a distinctly different shape 
from the other two hard keys. 



24. An economically efficient and easy to use human interface for a medical 
instrument especially suited for use by a user other than trained professional medical 
personnel, comprising: 

a) a display assembly comprising a housing having a front surface; 

b) a touch screen incorporated into said front surface; 

c) a plurality of hard keys incorporated into said front surface placed adjacent to 
said touch screen, said touch screen displaying a message prompting said user to 
press both said touch screen and at least one of said hard keys during operation 
of said human interface of said medical instrument to change a parameter 
pertinent to said instrument or pertinent to a treatment performed by said 
instrument on said patient; 

d) wherein each of said plurality of hard keys presents a substantially different 
visual appearance to a user so as to readily permit said user to associate each of 
said plurality of hard keys with a different functional attribute associated with 
said operation of said human interface. 
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25. The user interface of claim 24, wherein said plurality of hard keys comprise first, 
second and third hard keys each having a distinctly different color. 



26. The user interface of claim 25, wherein said first hard key has a red color and 
5 associated with a emergency stop function , said second hard key having a blue color 
and associated with an entry function, and said third hard key has a green color and 
associated with a confirmation function, said first second and third hard keys located 
adjacent said touch screen on said front surface of said display. 

10 27. The user interface of claim 25, wherein said display assembly is mounted to a 
free end of an arm connected to said medical instrument, with said display rotatable 
relative to said arm about at least one axis. 

28. The user interface of claim 25, wherein at least one of said hard keys has a 
15 distinctly different shape from the other two of said hard keys. 

29. The user interface of claim 18, further comprising a handle portion below said 
touch screen comprising a lower lip enabling a user to grasp said user interface housing 
and a front surface extending across a portion of the width of said housing, said lower 

20 lip and said front surface enabling a user to manually manipulate said user interface 
housing in a manner to cause rotation of said user interface about said at least one axis 
relative to said machine and said at least one axis relative to said arm 
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